PT-2015-6938 · Modern Tribe · Modern Tribe Eventbrite Tickets

Tom Adams · Published 2015-08-18 · Updated 2015-08-19 · CVE-2015-5485

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Modern Tribe Eventbrite Tickets plugin versions prior to 3.10.2

Description The issue is related to a cross-site scripting (XSS) vulnerability in the Event Import page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the error parameter to the "wp-admin/edit.php" endpoint.

Recommendations For versions prior to 3.10.2, update to version 3.10.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the import-eventbrite-events.php page and the wp-admin/edit.php endpoint to minimize the risk of exploitation. Avoid using the error parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-5485

Affected Products

Modern Tribe Eventbrite Tickets

References · 5

• 🔥 http://seclists.org/fulldisclosure/2015/Jul/67 · Exploit
• 🔥 https://security.dxw.com/advisories/reflected-xss-in-the-events-calendar-eventbrite-tickets-allows-unauthenticated-users-to-do-almost-anything-an-admin-can · Exploit
• 🔥 http://packetstormsecurity.com/files/132676/The-Events-Calender-Eventbrite-Tickets-3.9.6-Cross-Site-Scripting.html · Exploit
• https://theeventscalendar.com/release-eventbrite-tickets-3-10-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5485 · Security Note